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Report  No.  P099-6-002  March  23, 1999 

(Project  No.  70A-1005) 

Evaluation  of  the  Department  of  the  Army 
Internal  Review  Organizations 


Executive  Summary 


Introduction.  The  Department  of  the  Army  is  the  only  Military  Department  that 
maintains  a  central  internal  audit  agency,  the  U.S.  Army  Audit  Agency,  and  a  separate 
internal  review  organization,  the  Army  Internal  Review.  The  Army  Internal  Review 
organizations*  provide  a  full  range  of  services  to  the  Department  of  the  Army  commands, 
installations,  and  activities,  including  foil-scope  internal  audits,  quick  response  audits, 
consulting  services,  and  liaison  services.  The  Army  Internal  Review  organizations  also 
perform  followup  on  General  Accounting  Office;  Inspector  General,  DoD;  and 
U.S.  Army  Audit  Agency  audits  which  involve  Army  commands.  As  of  March  31,  1998, 
the  Army  Internal  Review  program  employed  approximately  500  auditors  located  at  172 
Army  Internal  Review  offices.  The  Army  Internal  Review  reported  FY  1997  operating 
costs  of  $30.5  million  and  operating  costs  for  the  first  half  of  FY  1998  of  $14.8  million. 

Objectives.  The  evaluation  objectives  were  to  determine  whether  the  Army  Internal 
Review  organizations  effectively  use  their  resources  and  have  an  adequate  planning 
process  for  audits  and  whether  the  Army  Internal  Review  staffing  levels  are 
commensurate  with  audit  organizations  in  other  Military  Departments. 

Results.  During  FY  1997,  the  Army  Internal  Review  organizations  expended  38  percent 
of  their  direct  time  performing  audits  and  the  remaining  62  percent  of  their  direct  time  on 
non-audit  work  (consulting,  liaison,  and  followup).  During  this  period,  the  Army  Internal 
Review  organizations  completed  2,638  reviews  and  reported  $341.8  million  in  potential 
monetary  benefits.  These  results  reflect  a  continued  pattern  of  improvement  in  the  Army 
Internal  Review  operations  resulting  from  reengineering  and  performance  measures 
implemented  by  the  Office  of  the  Assistant  Secretary  of  the  Army  (Financial 
Management  and  Comptroller)  beginning  in  FY  1994.  The  intent  of  the  reengineering 
was  to  make  the  Army  Internal  Review  more  responsive  to  Army  commanders.  Overall, 
the  Army  Internal  Review  organizations  reviewed  are  being  used  effectively.  However, 
the  Army  Internal  Review  program  could  be  further  enhanced. 

•  Improvements  could  be  made  in  the  areas  of  compliance  with  generally  accepted 
government  auditing  standards  and  regulations,  followup,  supervisory  reviews, 
and  quality  assurance  programs  (finding  A). 


*Our  review  focused  on  all  the  Army  Internal  Review  organizations  except  for  the  Corps  of  Engineers  and 
the  National  Guard  Bureau.  The  Inspector  General,  DoD,  performed  quality  assurance  reviews  on  these 
organizations  in  FY  1992  and  FY  1993,  respectively.  Therefore,  the  term  Army  Internal  Review  in  this 
report  excludes  reference  to  the  Corps  of  Engineers  and  the  National  Guard  Bureau  Internal  Review 
organizations. 


•  The  Army  Internal  Review  offices  visited  did  not  consistently  prepare  the 
required  annual  audit  plans,  define  or  support  the  basis  for  selection  of  the 
planned  reviews,  and  reconcile  or  justify  major  deviations  of  the  planned  work  to 
the  actual  work  accomplished.  Lack  of  an  effective  planning  process,  to  include 
the  preparation  of  dynamic  and  flexible  annual  plans,  could  result  in  the 
ineffective  and  inefficient  use  of  Army  Internal  Review  resources  (finding  B). 

The  combined  staffing  level  of  the  Department  of  the  Army  audit  organizations  is  closest 
in  comparison  to  the  staffing  level  of  the  Air  Force  Audit  Agency.  However,  differences 
in  the  organizational  structures,  number  of  installations  served,  and  workload  mix  affect 
the  comparison  of  Army  Internal  Review  to  other  military  department  audit 
organizations.  In  comparing  the  staffing  levels  of  the  Department  of  the  Army  audit 
organizations  and  the  Air  Force  Audit  Agency,  there  was  no  evidence  to  support  that  the 
staffing  levels  are  not  commensurate  (Appendix  C). 

Summary  of  Recommendations.  We  recommend  the  Assistant  Secretary  of  the  Army 
(Financial  Management  and  Comptroller)  ensure  that  the  Army  Internal  Review  complies 
with  continuing  professional  education  requirements,  improves  supervision  provided, 
conducts  adequate  internal  quality  assurance  reviews,  implements  more  explicit 
performance  plans  for  supervisory  personnel,  and  updates  its  planning  guidance.  We  also 
recommend  the  Auditor  General,  Department  of  the  Army  conduct  an  external  quality 
control  review  of  the  Army  Internal  Review  program  within  1  year  from  the  date  of  this 
report,  and  at  a  minimum,  every  3  years  thereafter. 

Management  Comments.  The  Assistant  Secretary  of  the  Army  (ASA)  (Financial 
Management  and  Comptroller)  (FM&C)  and  the  Auditor  General,  Department  of  the 
Army,  concurred  with  the  recommendations.  The  ASA  FM&C  stated  that  they  will 
emphasize  the  need  for  all  Internal  Review  auditors  to  comply  with  continuing 
professional  education  requirements,  the  need  for  external  quality  assurance  reviews,  and 
identify  key  elements  of  supervisory  performance  plans.  The  ASA  FM&C  also  will 
update  Army  Regulation  1 1-7  to  address  the  appropriate  level  of  supervision  and  to 
incorporate  new  review  planning  guidance.  The  Auditor  General  concurred  that  an 
external  review  of  the  Army  Internal  Review  needs  to  be  done  at  least  every  3  years.  In 
reference  to  performing  a  review  within  1  year  from  the  date  of  this  report,  the  Auditor 
General  concurred  but  noted  that  the  1  year  time  frame  may  not  give  the  Army  Internal 
Review  sufficient  time  to  implement  corrective  actions  recommended  in  this  report.  See 
the  report  findings  for  a  summary  of  management  comments  and  the  management 
comments  section  of  the  report  for  the  complete  text  of  management  comments. 
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Background 


Internal  Review  Organizations.  The  DoD  Directive  7600.2,  “Audit  Policies,” 
February  2, 1991,  states  that  the  DoD  components  may  establish  internal  review 
(IR)  organizations  to  provide  local  commanders  with  an  internal  audit  capability 
to  resolve  known  or  suspected  problem  areas  and  operational  deficiencies  and  to 
supplement  the  audit  services  provided  by  the  cognizant  internal  audit 
organization.  Those  IR  organizations  are  considered  to  be  audit  organizations  and 
are  expected  to  comply  with  appropriate  auditing  standards.  According  to  DoD 
Directive  7600.2,  the  IR  organizations  may  also  be  used  to  perform  liaison 
services  and  audit  followup.  The  Department  of  the  Army  maintains  a  central 
internal  audit  agency,  the  U.S.  Army  Audit  Agency  (AAA),  and  an  IR 
organization,  the  Army  IR. 

The  Army  Regulation  (AR)  36-5,  “Auditing  Service  in  the  Department  of  the 
Army,”  December  16, 1991,  further  explains  the  role  of  Army  IR  offices.  This 
regulation  states  that  the  Army  IR  offices  will  provide  an  internal  audit  capability 
and  perform  audits  in  accordance  with  generally  accepted  government  auditing 
standards  (GAGAS),  issued  by  the  Comptroller  General  of  the  United  States,  and 
audit  policies  prescribed  by  the  Auditor  General,  Department  of  the  Army.  The 
Army  IR  mission  is  to  support  the  Department  of  the  Army  by  providing 
objective,  reliable,  and  timely  information  to  decision  makers.  The  Army  IR 
personnel  perform  internal  audits  of  mission  and  support  operations  within  the 
command;  evaluate  internal  controls,  operating  performance,  and  compliance  with 
legal  and  regulatory  requirements;  and  implement  directives  from  higher  authority 
that  relate  to  Army  IR  policies.  The  Army  IR  organizations  are  staffed  with 
auditors  and  are  funded  at  the  command  level  as  part  of  the  commanders’ 
operating  budget.  The  Army  IR  personnel  report  directly  to  the  commanders, 
principal  deputy  commanders,  or  chiefs  of  staff,  and  are  responsive  to  command 
requests  and  concerns. 

Oversight  Responsibility.  The  Office  of  the  Assistant  Secretary  of  the  Army 
(Financial  Management  and  Comptroller)  [ASA  (FM&C)]  has  overall 
responsibility  for  the  Army  IR  program.  The  Office  of  the  Director,  Internal 
Review  and  Management  Control  (Army  IR  headquarters),  within  the  Office  of 
the  ASA  (FM&C),  is  responsible  for  coordinating  and  directing  all  Army  IR 
activities,  to  include  developing  Army  IR  policy,  monitoring  the  execution  of  the 
Army  IR  program  at  the  major  Army  commands  (MACOMs),  and  overseeing  the 
Army  IR  auditors’  training  program.  The  Auditor  General,  Department  of  the 
Army  is  responsible  for  establishing  audit  policy  and  prescribing  training  for  all 
Department  of  the  Army  auditors  and  periodically  evaluating  the  effectiveness  of 
the  Army  IR  program. 
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Objectives 


The  evaluation  objectives  were  to  determine  whether  the  Army  IR  organizations 
effectively  use  their  resources  and  have  an  adequate  planning  process  for  audits 
and  whether  the  Army  IR  staffing  levels  are  commensurate  with  audit 
organizations  in  other  Military  Departments.  Refer  to  Appendix  A  for  a 
discussion  of  the  evaluation  scope  and  methodology  and  Appendix  B  for  the 
related  prior  coverage. 
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A.  Army  Internal  Review  Effectiveness 
and  Compliance  with  Standards 

During  FY  1997,  the  Army  IR  organizations  expended  38  percent  of  then- 
direct  time  performing  audits  and  the  remaining  62  percent  of  their  direct 
time  on  non-audit  work  (consulting,  liaison,  and  followup).  During  this 
period,  the  organizations  completed  2,638  reviews  and  reported 
$341.8  million  in  potential  savings.  Customer  satisfaction  surveys  for 
FY  1997  and  FY  1998  showed  approval  ratings  of  4.19  and  4.35, 
respectively,  out  of  a  possible  score  of  5.0.  These  results  reflect  a 
continued  pattern  of  improvement  in  the  Army  IR  operations  resulting 
from  reengineering  and  performance  measures  implemented  by  the  Office 
of  the  ASA  (FM&C)  beginning  in  FY  1994.  Overall,  the  Army  IR 
organizations  reviewed  are  being  used  effectively;  however, 
improvements  could  be  made  in  the  areas  of  compliance  with  GAGAS  and 
regulations,  followup,  supervisory  reviews,  and  quality  assurance 
programs. 


Reengineering  Efforts  and  Performance  Measurements 

Reengineering  Efforts.  During  FY  1994,  the  Office  of  the  ASA  (FM&C) 
conducted  a  utilization  assessment  in  response  to  Army  IR  downsizing.  As  a 
result  of  this  assessment,  the  ASA  (FM&C)  directed  a  number  of  changes  to 
enhance  the  performance  of  the  Army  IR  function  and  to  cope  with  declining 
budgets,  staffing  reductions,  and  changing  needs  of  Army  IR  customers.  Some  of 
the  important  changes  included  the  development  of  an  Army  IR  strategic  plan;  the 
use  of  steering  committees  and  process  improvement  teams;  and  the  performance 
of  more  quick  response  audits  and  consulting  reviews  and  fewer  time-consuming, 
full-scope  internal  audits. 

Performance  Measurements.  As  part  of  its  continuing  reengineering  efforts,  the 
Office  of  the  ASA  (FM&C)  also  developed  the  Army  IR  Performance  Measures 
Guide  (the  Guide),  effective  September  8, 1997  The  Guide  was  a  result  of  the 
efforts  of  a  process  action  team  composed  of  members  of  the  Army  IR 
community  as  well  as  Army  IR  customers.  The  Guide  was  designed  for  use  at  the 
Army,  MACOM,  and  individual  office  levels,  to  assess  Army  IR  performance  and 
to  facilitate  benchmarking  within  the  Army  IR  community.  According  to  the 
Guide,  the  Army  IR  performance  measurements  include  return  on  investment; 
auditor  productivity;  customer  satisfaction;  and  effective  use  of  Army  IR. 
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Based  on  the  Army  IR  headquarters’  data  and  the  results  of  the  FYs  1997  and 
1998  customer  satisfaction  surveys,  the  Army  IR  organizations  significantly 
improved  their  effectiveness  since  FY  1994.  Specific  improvements  included  the 
following. 

•  Return  on  investment  is  more  than  eight  times  pre-reengineering  levels. 

•  Total  number  of  Army  IR  reviews  increased  significantly  from  the 
FY  1993  level.  In  FY  1993,  760  Army  IR  auditors  completed  1,712 
reviews.  In  FY  1997,  484  auditors  completed  2,638  reviews. 

•  Direct  days  per  Army  IR  project  decreased  from  the  FY  1993 
measurement  of  51  direct  days  per  project  to  21  direct  days  per  project  for 
FY  1997. 

•  The  customer  satisfaction  survey  results  for  the  first  quarter  of  FY  1998 
showed  an  increased  overall  customer  satisfaction  ratio  of  4.35  out  of  a 
possible  score  of  5.0  (up  from  4. 19  in  FY  1997). 

In  addition,  as  of  June  1998,  Army  IR  headquarters  initiated  several  new 
reengineering  efforts,  including  new  process  improvement  teams  for  audit  time 
reporting;  consulting  and  advisory  services;  Army  IR  access  to  information;  and 
outsourcing  internal  audits  (Appendix  D).  Also,  the  Director,  Financial  Reporting 
and  Internal  Review,  highlighted  additional  priorities  for  the  coming  year 
including  auditor  training,  the  need  for  additional  reengineering  initiatives,  and 
relations  with  the  AAA. 


Compliance  with  GAGAS  and  Regulations 

Professional  Proficiency.  According  to  GAGAS,  the  staff  assigned  to  conduct 
audits  should  collectively  possess  adequate  professional  proficiency  for  the  tasks 
required.  The  audit  organizations  should  have  a  program  to  ensure  that  their 
auditors  maintain  professional  proficiency  through  continuing  education  and 
training.  The  AR  1 1-7,  “Internal  Review  and  Audit  Compliance  Program,” 

July  16, 1989,  requires  that  the  Army  IR  staff  be  composed  of  professionally 
qualified  auditors  in  the  Federal  employee  General  Schedule  511  series  and 
follow  GAGAS.  In  addition,  the  Auditor  General,  Department  of  the  Army  is 
required  to  prescribe  the  technical  audit  training  for  Army  IR  auditors.  The 
AR  11-7  also  states  that  commanders  should  encourage  active  participation  in  the 
training  programs  sponsored  by  the  Auditor  General,  Department  of  the  Army  and 
other  sources  and  actively  support  assigned  personnel  by  programming  and 
budgeting  training  costs.  The  Army  IR  office  chiefs  are  responsible  for  ensuring 
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that  each  auditor  receives  professional  audit  training  each  year.  Proper  training  of 
Army  IR  personnel  is  essential  to  maintaining  the  skills  and  knowledge  required 
in  the  auditing  profession. 

At  four  of  the  Army  IR  offices  visited,  10  of  the  67  auditors  did  not  have  the 
required  continuing  professional  education  training  hours.  For  example,  at  one  of 
the  Army  IR  offices  with  two  auditors,  neither  of  the  auditors  had  met  the 
professional  education  training  requirements  for  the  past  2  years.  At  another 
Army  IR  office,  only  one  of  the  six  auditors  met  the  prescribed  training 
requirement.  The  Army  IR  personnel  stated  that  they  did  not  comply  with  the 
GAGAS  and  AR  training  requirements  because  of  inadequate  locally  available 
audit-related  training  courses  and  insufficient  funds  included  in  the  local  Army  IR 
office  budget  for  travel  to  training  courses.  Because  Army  IR  auditors  have  not 
complied  with  the  continuing  professional  education  requirements,  there  is  no 
assurance  that  the  quality  of  some  of  the  review  work  performed  meets  GAGAS. 

Performance  of  Audit  Work.  The  GAGAS  include  the  following  standards  for 
audit  work. 

•  Audits  should  be  adequately  planned.  In  addition,  auditors  should  prepare 
a  written  audit  program  for  each  audit,  with  suggested  audit  steps  and 
procedures  to  answer  audit  objectives. 

•  Audit  staff  are  to  be  properly  supervised. 

•  Auditors  should  gather  sufficient,  competent,  and  relevant  evidence  to 
support  their  conclusions  and  document  their  work  in  working  papers. 

•  Auditors  should  prepare  written  reports  communicating  the  results  of  each 
audit.  Auditors  should  report  the  audit  objectives,  scope,  and 
methodology.  Auditors  should  also  report  that  the  audit  was  made  in 
accordance  with  GAGAS. 

In  addition,  AR  1 1-7  states  that  each  audit  is  normally  preceded  by  a  survey 
phase,  an  audit  guide  is  normally  developed  to  help  achieve  an  organized 
approach,  and  Army  IR  office  chiefs  will  ensure  that  audit  reports  and  working 
papers  comply  with  GAGAS. 

For  the  46  audit  projects  reviewed,  43  of  the  projects  contained  133  working 
paper  deficiencies,  and  27  of  the  projects  contained  53  reporting  deficiencies 
when  compared  to  the  GAGAS  and  AR  1 1-7  documentation  and  reporting 
requirements.  For  example,  the  working  papers  for  8  audit  projects  contained  no 
evidence  of  planning  prior  to  the  performance  of  the  audit  work,  to  include 
performing  audit  surveys;  auditors  did  not  prepare  adequate  audit  programs  for 
15  audit  projects;  and  working  papers  did  not  adequately  support  conclusions  for 
10  of  the  Army  IR  audit  projects.  In  addition,  16  of  the  audit  reports  reviewed  did 
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not  cite  adherence  to  GAGAS  or  qualify  when  GAGAS  were  not  complied  with; 

1 1  audit  reports  did  not  adequately  identify  the  scope  and  methodology  for  the 
work  performed;  and  6  reports  did  not  identify  the  causes  for  the  conditions 
identified. 

Performance  of  Consulting  Reviews.  The  GAGAS  state  that  auditors  may 
perform  services  other  than  audits  and  that  the  head  of  an  audit  organization  may 
wish  to  establish  policies  applying  standards  to  its  employees  performing 
non-audit  work.  The  Army  IR  headquarters  issued  two  memorandums,  on 
December  21,  1995,  and  May  2, 1996,  providing  guidance  for  the  performance 
and  documentation  of  consulting  and  advisory  services.  The  December  21, 1995, 
memorandum  defines  consulting  and  advisory  services  as  services  provided  to  the 
command  that  are  not  financial  or  performance  audits.  According  to  the  Army  IR 
guidance,  as  a  minimum,  the  Army  IR  auditors  performing  a  consulting  service, 
will  document  the  following: 

•  understanding  with  the  command  as  related  to  the  auditor’s 
responsibilities,  to  include  the  review  objectives,  the  responsibilities  of  the 
auditor  and  command  personnel,  and  the  review  limitations; 

•  work  methodology  and  data  analyzed; 

•  communications  with  command  personnel; 

•  time  sheets  that  identify  the  names  of  the  auditors  and  the  number  of  hours 
worked; 

•  supervisory  reviews;  and 

•  results  of  the  consulting  service  engagement,  to  include  a  qualification 
statement  citing  the  extent  to  which  the  auditor  complied  with  GAGAS 
during  the  performance  of  the  consulting  review. 

Of  the  26  consulting  projects  reviewed,  23  contained  72  deficiencies  relating  to 
working  paper  documentation  and  19  contained  39  reporting-related  deficiencies 
when  compared  to  the  Army  IR  guidance.  For  example,  auditors  did  not 
adequately  document  in  the  working  papers  the  understanding  with  the  command 
personnel  for  17  of  the  26  consulting  projects;  2  consulting  projects  did  not  have 
working  papers  to  support  the  auditors’  conclusions;  6  consulting  projects’ 
working  papers  did  not  include  time  sheets  identifying  the  names  of  the  auditors 
and  the  number  of  hours  worked;  and  17  final  products  did  not  include  the 
required  GAGAS  qualification  statement. 

Followup  Systems.  According  to  DoD  Directive  7650.3,  “Follow-up  on  General 
Accounting  Office,  DoD  Inspector  General,  and  Internal  Audit  Reports,” 
September  5, 1989,  followup  is  a  responsibility  shared  by  DoD  managers  and 
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oversight  personnel.  Followup  is  the  collective  effort  made  to  ensure  that  prompt, 
effective,  and  coordinated  corrective  action  is  taken  to  implement 
recommendations  and  that  controls  are  adequate  to  prevent  the  recurrence  of 
deficiencies.  According  to  AR 1 1-7,  the  primary  objective  of  the  audit  followup 
process  is  to  determine  whether  agreed-on  audit  findings  and  recommendations 
have  been  translated  into  management  actions  that  will  correct  identified 
problems.  The  AAA  monitors  until  implemented  its  recommendations  and 
associated  estimates  of  potential  monetary  benefits  that  have  been  agreed  to  by 
the  AAA  and  the  Department  of  the  Army  personnel  responsible  for 
implementing  the  recommendations.  According  to  AR  36-2,  “Audit  Reports  and 
Follow-up,”  April  26, 1991,  at  Army  field  activities,  this  followup  function  is 
performed  by  the  local  Army  IR  office.  Within  the  past  5  years,  AAA  performed 
reviews  of  the  followup  systems  at  certain  Army  IR  offices  (Appendix  B). 

Six  of  the  12  Army  IR  offices  visited  did  not  have  adequate  systems  to  track  the 
status  of  or  perform  timely  followup  on  external  or  internal  audit 
recommendations  as  required  by  DoD  Directive  7650.3  and  AR  11-7.  However, 
the  Army  IR  headquarters,  in  coordination  with  the  AAA,  implemented  an 
electronic  submission  of  information  for  the  semiannual  followup  status  reports 
using  the  Army  IR  Internet  web  page.  The  electronic  submission  should  provide 
visibility  to  those  report  recommendations  requiring  followup  actions.  This  new 
reporting  system,  designed  to  streamline  the  Army  IR  offices’  reporting,  improve 
the  accuracy  of  the  reports  submitted,  reduce  report  preparation  time,  and  improve 
the  MACOM  IR  offices’  oversight  of  subordinate  Army  IR  pffices  required 
reporting,  was  made  available  to  the  Army  IR  offices  during  November  1998.  As 
a  result  of  this  initiative,  we  are  not  making  a  recommendation  related  to  followup 
systems  at  this  time. 


Supervisory  Reviews  and  Quality  Assurance  Programs 

The  deficiencies  in  auditor  training,  working  paper  and  reporting  documentation, 
and  followup,  resulted  in  part  from  the  lack  of  adequate  supervision  and  an 
ineffective  quality  assurance  program.  The  Army  IR  office  chiefs  are  not 
ensuring  that  auditors  are  receiving  the  required  training  and  are  not  consistently 
implementing  the  Army  IR  quality  assurance  program  to  ensure  that  the  Army  IR 
products  meet  GAGAS,  DoD  regulations,  and  Army  regulations. 

Supervisory  Reviews.  The  GAGAS  state  that  supervision  involves  directing  the 
efforts  of  auditors  who  are  involved  in  the  audit  to  determine  whether  the 
objectives  are  being  accomplished.  Elements  of  supervision  include  instructing 
staff  members,  keeping  informed  of  significant  problems  encountered,  reviewing 
the  work  performed,  and  providing  effective  on-the-job  training.  However,  for  34 
of  the  46  audit  projects  reviewed  and  9  of  the  26  consulting  projects  reviewed,  the 
working  papers  did  not  contain  evidence  supporting  supervision  of  the  Army  IR 
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auditors  during  the  review  or  during  preparation  of  the  report.  Army  IR  office 
chiefs  did  not  complete  quality  control  reviews  to  verify  the  accuracy  for  39  of  the 
46  audit  products  and  22  of  the  26  consulting  projects.  The  management  and  staff 
at  the  Army  IR  offices  stated  that  the  reduced  staffing  levels  (four  of  the  Army  IR 
offices  visited  were  staffed  with  only  one  or  two  auditors)  make  it  increasingly 
difficult  for  the  Army  IR  personnel  to  adequately  perform  some  of  their  functions, 
including  documenting  supervisory  reviews  or  quality  control  reviews  performed 
on  supporting  working  papers  and  final  Army  IR  products. 

Quality  Assurance  Programs.  The  GAGAS  require  that  each  audit  organization 
conducting  audits  should  have  an  appropriate  internal  quality  control  system  in 
place  and  should  undergo  an  external  quality  control  review.  The  Army  IR 
headquarters  issued  a  memorandum,  dated  April  8, 1997,  which  required  that 
audit  reports  be  qualified  if  the  IR  office  was  not  in  compliance  with  the  GAGAS 
quality  control  review  requirements. 

Quality  Assurance  Guide.  The  Army  IR  headquarters  issued  a  policy 
memorandum  implementing  a  revised  Quality  Assurance  Guide  on  September  3, 
1997.  The  Quality  Assurance  Guide  clarified  the  Army  IR  internal  quality  control 
system  and  instructed  all  Army  IR  offices  to  use  the  Quality  Assurance  Guide 
during  the  performance  of  internal  quality  assurance  reviews.  The  policy 
memorandum  states  that  with  the  exception  of  reviews  scheduled  by  the  Inspector 
General,  DoD,  or  the  AAA,  the  MACOM  IR  office  chiefs  have  the  final  approval 
authority  for  determining  who  conducts  the  internal  quality  assurance  reviews  on 
subordinate  offices.  The  memorandum  also  instructed  the  chiefs  at  MACOM  IR 
offices  to  ensure  that  quality  assurance  reviews  had  been  performed  at  all 
subordinate  offices  within  the  3-year  period  ending  December  31,1 997.  The 
Quality  Assurance  Guide  does  not  include  instructions  for  the  performance  of 
internal  quality  assurance  reviews  on  MACOM  IR  offices.  However,  according 
to  Army  IR  headquarters,  the  MACOM  IR  office  chiefs  may  arrange  to  have 
auditors  from  other  MACOM  IR  offices  perform  the  required  reviews. 

Timeliness  of  Quality  Assurance  Reviews.  As  of  December  31, 1997,  of  the 
12  Army  IR  offices  in  our  sample,  2  MACOM  IR  offices  and  5  installation  IR 
offices  had  not  had  a  quality  assurance  review  of  their  office  during  the  last 
3  years.  Two  of  these  five  installation  IR  offices,  the  U.S.  Army  Aviation  and 
Missile  Command  HR.  office  and  the  Fort  Bragg  IR  office,  had  not  obtained  a 
quality  assurance  review  in  approximately  10  years.  However,  the  seven  IR 
offices  did  not  qualify  their  audit  products  to  indicate  the  noncompliance  with  the 
GAGAS  quality  control  review  requirements.  Not  obtaining  a  quality  assurance 
review  within  the  3-year  period  increases  the  risk  that  the  quality  of  the  audit 
work  produced  will  not  be  acceptable. 

Performance  of  Quality  Assurance  Reviews.  We  also  evaluated  the 
adequacy  of  the  performance  of  quality  assurance  reviews.  At  two  of  the  IR 
offices,  we  found  that  the  auditors,  using  the  Quality  Assurance  Guide,  did  not 
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prepare  working  papers  to  support  the  quality  assurance  ratings  assigned  and  did 
not  identify  the  projects  reviewed.  According  to  the  ER  office  chiefs  at  these  two 
offices,  the  deficiencies  were  caused  by  the  lack  of  auditor  trailing  in  the 
performance  of  internal  quality  assurance  reviews  and  the  lack  of  instructions 
provided  with  the  Quality  Assurance  Guide.  Also  at  another  IR  office,  we 
reviewed  the  quality  assurance  report  issued  by  its  MACOM  IR  office  and  the 
audit  project  used  to  assign  the  quality  assurance  rating.  The  results  of  our 
evaluation  of  the  audit  working  papers  and  the  MACOM  IR  office's  reported 
results  differed  significantly.  The  MACOM  IR  office's  quality  assurance  report 
identified  only  nonmaterial  deficiencies.  However,  the  audit  working  papers  and 
audit  report  were  materially  deficient  and  did  not  comply  with  GAGAS.  For 
example,  there  was  no  audit  program,  and  the  audit  working  papers  did  not 
include  source,  purpose,  scope,  and  conclusions.  In  addition,  there  was  no 
evidence  of  supervisory  review  of  the  working  paper  files.  When  we  discussed 
the  differences  between  the  reported  results  and  our  results  with  the  MACOM  IR 
office  chief,  he  stated  that  it  was  more  important  that  the  audit  report  was  useful 
and  important  to  the  command.  However,  a  quality  assurance  program  that  does 
not  emphasize  accuracy  in  reporting  and  documenting  quality  assurance  review 
results  would  provide  little  benefit  to  the  Army  IR  management. 

External  Reviews.  The  AAA  is  responsible  for  conducting  the  external 
quality  control  reviews  of  the  Army  IR  organizations.  The  reviews  are  performed 
to  ensure  that  GAGAS  are  met,  audit  quality  is  kept  at  a  high  level,  and  adequate 
management  controls  are  applied  to  the  audit  process.  The  AAA  had  not 
conducted  an  overall  external  quality  control  review  of  the  Army  IR  program 
since  1990.  According  to  AAA  personnel,  the  AAA  planned  to  perform  reviews 
of  Army  IR  in  FY  1994  and  FY  1997.  However,  AAA  personnel  stated  that  AAA 
cancelled  these  reviews  because  of  the  Army  IR  reengineering  efforts  and  a 
planned  Inspector  General,  DoD,  evaluation  review  of  Army  IR,  respectively. 

The  Inspector  General,  DoD,  conducted  external  quality  control  reviews  of  the 
Corps  of  Engineers  and  the  National  Guard  Bureau  Army  IR  organizations  in 
FYs  1992  and  1993,  respectively.  During  its  last  review,  the  AAA  identified 
deficiencies  similar  to  some  of  the  deficiencies  identified  in  this  evaluation  report. 
The  AAA  Advisory  Report  No.  EU  91-A1,  “Internal  Review  Functions,” 

January  21,  1991,  cited  the  following  systemic  problems  identified  during  audits 
of  the  Army  IR  function. 

•  Audit  staffs  did  not  document  audit  plans  in  their  audit  programs. 

•  Audit  staffs  did  not  receive  enough  guidance  and  supervision  to  make  sure 
they  did  audits  properly. 

•  Working  papers  that  linked  fieldwork  to  audit  reports  did  not  contain 
required  data  and  often  were  not  adequately  cross-referenced. 

•  IR  offices  often  did  not  report  audit  results  consistent  with  GAGAS. 
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Summary 


Recognizing  the  current  DoD  environment  of  downsizing  and  funding  constraints, 
the  Army  IR  has  reengineered  its  operations  to  use  its  resources  more  effectively. 
The  results  of  the  reengineering  efforts  have  been  favorable  as  evidenced  by 
reported  increases  in  productivity  and  improved  customer  satisfaction  ratings.  In 
addition,  the  Army  IR  headquarters  issued  appropriate  guidance  as  necessary. 
However,  as  evidenced  by  our  evaluation  results,  the  IR  offices’  compliance  with 
applicable  regulations  and  Army  IR  guidance  needs  improvement.  Otherwise, 
Army  IR  audit  products  issued  will  have  to  be  qualified  to  the  point  where  their 
credibility  becomes  questionable.  Increased  compliance  with  applicable 
requirements  pertaining  to  continuing  professional  education  and  working  paper 
and  reporting  documentation  could  enhance  the  effectiveness  of  Army  IR. 
Increased  emphasis  on  supervision  and  the  quality  assurance  program  will  help  to 
ensure  that  the  Army  IR  issues  reliable  products  that  are  supported  by  sufficient, 
competent,  and  relevant  documentation.  Compliance  with  applicable 
requirements  and  guidance  for  performing  audit  and  non-audit  work  should 
improve  the  quality  and,  therefore,  the  effectiveness  of  Army  IR. 


Recommendations  and  Management  Comments 

A.  We  recommend  the  Assistant  Secretary  of  the  Army  (Financial 
Management  and  Comptroller)  ensure  that: 

1.  Army  Internal  Review  auditors  comply  with  the  continuing 
professional  education  training  requirements. 

Management  Comments.  The  Army  concurred  stating  that  a  memorandum 
stressing  the  need  for  all  Internal  Review  auditors  to  comply  with  continuing 
professional  education  requirements  will  be  published  by  April  15, 1999. 

2.  Army  Internal  Review  office  chiefs  provide  additional  supervision 
and  attention  to  the  Internal  Review  personnel  to  ensure  the  quality  of  the 
products  issued.  The  additional  supervision  and  attention  should  include 
documenting  of  supervisory  reviews  of  working  papers  for  audits  and 
consulting  projects  and  completion  of  quality  control  reviews  for  final 
products  in  accordance  with  generally  accepted  government  auditing 
standards  and  Army  guidance. 


1  Army  Management's  response  to  the  recommendations  stated  that  the  memoranda  to  be  issued  in 
reference  to  Recommendations  1, 3,  and  4  would  be  published  by  March  15, 1999.  However,  in 
subsequent  discussions  with  Army  Management  they  requested  that  time  be  extended  to  April  15,  1999. 


Management  Comments.  The  Army  concurred  stating  that  a  guide  for 
determining  the  level  of  supervisory  review  of  Internal  Review  engagements  will 
be  incorporated  into  Army  Regulation  11-7  within  1  year.  The  new  guidance  will 
be  in  accordance  with  Government  Auditing  Standards. 

3.  Internal  quality  assurance  reviews  are  conducted  in  accordance 
with  Army  Internal  Review  guidance. 

Management  Comments.  The  Army  concurred  stating  that  a 
memorandum  stressing  the  need  for  Army  Major  Commands  to  ensure  all 
subordinate  Internal  Review  offices  receive  an  external  quality  assurance  review 
at  least  every  3  years  will  be  issued  by  April  15, 1999. 

4.  Performance  plans  of  Army  Internal  Review  supervisory  personnel 
explicitly  include  performance  elements  related  to  recommendations  A.I., 
A.2.,  and  A.3. 


Management  Comments.  The  Army  concurred  stating  that  a 
memorandum  identifying  key  elements  of  supervisory  performance  plans  for 
Internal  Review  personnel  will  be  published  by  April  15, 1999. 

A.5.  We  recommend  that  the  Auditor  General,  Department  of  the 
Army  conduct  an  external  quality  control  review  of  the  Army  Internal 
Review  program  within  1  year  from  the  date  of  this  report,  and  a  minimum 
of  every  3  years  thereafter. 

Management  Comments.  The  Auditor  General  concurred  and  expressed 
concern  that  the  1  year  time  frame  would  not  allow  sufficient  time  for  Army 
Internal  Review  to  fully  implement  corrective  actions  for  all  recommendations 
addressed  to  them.  However,  in  subsequent  discussions  the  Auditor  General's 
staff  stated  that  an  external  quality  control  review  will  be  performed  within  1  year 
of  the  date  of  this  report  and  subsequent  reviews  at  a  minimum  of  every  3  years. 
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B.  Army  Internal  Review  Planning 
Process 

The  Army  IR  offices  visited  did  not  consistently  prepare  the  required 
annual  audit  plans,  define  or  support  the  basis  for  selection  of  the  planned 
reviews,  and  reconcile  or  justify  major  deviations  of  the  planned  work  to 
the  actual  work  accomplished.  The  noncompliance  occurred  because 
Army  IR  office  chiefs  believed  that  annual  plans  are  often  invalid  soon 
after  they  are  developed  due  to  limited  audit  resources  and  the  emphasis 
on  command-requested  quick  response  audits  and  consulting  reviews.  As 
a  result,  the  IR  office  chiefs  did  not  place  a  high  priority  on  the 
preparation  of  complete  and  accurate  annual  audit  plans.  Lack  of  an 
effective  planning  process,  to  include  the  preparation  of  dynamic  and 
flexible  annual  plans,  could  result  in  the  ineffective  and  inefficient  use  of 
Army  IR  resources. 


Annual  Audit  Plan 

Plan  Requirement.  The  AR 1 1-7  requires  all  Army  IR  offices  to  prepare  an 
annual  plan  containing  the  workload  scheduled  to  be  performed  during  a  specific 
calendar  year  and  to  submit  the  plan  to  its  next  higher  headquarters.  The  plan 
should  ensure  that  auditor  resources  are  used  effectively  and  efficiently;  coverage 
of  high  risk,  high  payback  mission  areas  is  maximized;  and  adequate  coverage  is 
provided  to  all  functional  elements  with  known  or  suspected  problems.  However, 
the  current  AR  11-7  was  developed  before  electronic  information  exchange  and 
Internet  access  to  data  became  popular  alternatives  to  meeting  publishing 
requirements.  Therefore,  the  Army  needs  to  update  its  current  guidance  on  the 
Army  IR  planning  process  and  consider  more  recent  dynamic,  flexible,  and 
real-time  alternatives. 

Plan  Preparation.  Seven  of  the  12  Army  IR  offices  visited  did  not  prepare 
annual  audit  plans  as  required.  For  example,  one  Army  IR  office  had  not 
developed  an  annual  audit  plan  prior  to  1998,  and  one  Army  IR  office  did  not 
develop  an  annual  audit  plan  for  1997.  When  the  seven  Army  IR  offices  did 
develop  plans,  they  prepared  annual  plans  several  months  after  the  start  of  their 
planning  year.  These  deficiencies  occurred  because  Army  IR  management  did 
not  place  a  high  priority  on  the  timely  preparation  of  annual  audit  plans. 

Documentation.  According  to  the  AR  1 1-7,  the  annual  plans  should  provide  the 
specific  reasons  for  selecting  the  area  for  audit  and  all  available  staff  days  should 
be  programmed.  In  addition,  the  Army  IR  headquarters  issued  an  Army  IR 
Planning  Guide,  effective  August  1997,  recommending  that  annual  audit  plans 
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include  information  as  to  the  type,  priority,  and  objectives  for  each  proposed 
review.  At  3  of  the  12  Army  IR  offices  visited,  however,  the  annual  audit  plans 
did  not  specify  the  basis  for  the  selection  of  the  proposed  reviews.  At  two  other 
IR  offices,  the  annual  plans  did  not  account  for  all  available  staff  days. 
Furthermore,  at  six  Army  IR  offices,  the  annual  audit  plans  did  not  prioritize  the 
work  to  be  accomplished  for  the  year.  The  Army  IR  management  stated  that  the 
review  work  they  perform  was  based  on  the  needs  of  the  local  commanders,  so 
the  commanders  dictate  the  Army  IR  work  priority. 

Submission.  The  AR 11-7  states  that  the  major  Army  commanders  and  then- 
subordinate  commanders  will  evaluate  the  effectiveness  of  their  Army  IR 
elements  to  include  the  annual  Army  IR  audit  plan.  The  regulation  further  states 
that  copies  of  the  approved  annual  plan  will  be  submitted  to  the  next  higher 
headquarters.  For  example,  the  installation  IR  offices  should  submit  annual  audit 
plans  to  their  MACOM  IR  offices  and  the  MACOM  IR  offices  should  submit 
their  annual  audit  plans  to  Army  IR  headquarters.  Three  of  the  12  offices  did  not 
comply  with  this  requirement.  The  chief  at  one  of  the  MACOM  IR  offices  stated 
that  he  did  not  require  his  subordinate  installation  Army  IR  offices  to  provide 
annual  audit  plans  because  the  plans  would  be  obsolete  by  the  time  he  received 
them  and  would  just  be  filed. 


Recommendation  and  Management  Comments 

B.  We  recommend  that  the  Assistant  Secretary  of  the  Army  (Financial 
Management  and  Comptroller)  update  the  Army  Regulation  11-7,  “Internal 
Review  and  Audit  Compliance  Program,”  July  16, 1989,  to  provide  for  a 
more  dynamic  and  flexible  planning  process. 

Management  Comments.  The  Army  concurred  stating  that  Army  Regulation 
11-7  will  be  revised  within  1  year  to  include  a  dynamic  and  more  flexible 
approach  to  Internal  Review  planning. 
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Appendix  A.  Evaluation  Process 


Scope  and  Methodology 

Work  Performed.  We  performed  evaluation  work  at  Army  IR  headquarters;  four 
MACOM  IR  offices,  and  eight  installation-level  Army  IR  offices.  We  did  not 
include  the  Corps  of  Engineers  or  the  National  Guard  Bureau  Army  IR 
organizations  in  our  evaluation.  We  reviewed  FYs  1996  through  1998 
Semiannual  Reports  to  the  Congress,  FYs  1996  through  1998  semiannual 
followup  status  reports,  and  documentation  supporting  the  annual  planning 
process.  In  addition,  we  reviewed  organizational  structure  and  operating  statistics 
for  the  Military  Departments’  audit  organizations.  We  also  analyzed  Army  IR 
personnel  training  records,  working  papers  and  related  reporting  documentation 
for  29  foil  scope  audits,  11  followup  audits,  6  quick  response  audits,  and 
26  consulting  reviews.  Although  we  believe  the  evaluation  results  accurately 
represent  Army  IR  operations,  they  are  not  projectable. 

Interviews.  We  interviewed  personnel  from  the  Office  of  the  ASA  (FM&C), 
Army  IR  headquarters,  Army  IR  offices,  AAA,  NAS,-  and  AFAA. 

Computer-Processed  Data.  We  used  Army  IR  headquarters’ 
computer-processed  data  applicable  to  the  Army  IR  reengineering  efforts  and 
performance  statistics.  We  did  not  test  the  validity  of  the  performance  data. 

Contacts  During  the  Evaluation.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Evaluation  Period  and  Scope.  We  performed  this  evaluation  from  August  1997 
through  October  1998.  The  scope  of  the  evaluation  was  limited  in  that  we  did  not 
review  the  Army  IR  management  control  program. 
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Appendix  B.  Summary  of  Prior  Coverage 

During  the  last  5  years,  AAA  performed  four  reviews  related  to  the  Army  IR 
program. 

AAA  Report  No.  AA  96-F3,  “Headquarters’  Internal  Review  Audit  Follow-up 
System  Review,”  May  20, 1996. 

AAA  Report  No.  AA  96-F2,  “Follow-up  System  Review,”  April  30,  1996. 

AAA  Report  No.  AA  96-F1,  “Headquarters’  Internal  Review  and  Audit 
Compliance  Follow-up  System  Review,”  December  19, 1995. 

AAA  Report  No.  HQ  95-F2,  “FY  94  Audit  Followup  System  Assessment 
U.S.  Army  Forces  Command,”  January  12,  1995. 

AAA  Report  No.  HQ  95-F1,  “FY  94  Audit  Followup  Review  Office  of  the 
Deputy  Chief  of  Staff  for  Operations  and  Plans,”  December  6, 1994. 

AAA  Report  No.  HQ  95-C2,  “Internal  Review  and  Audit  Compliance  Program, 
U.S.  Army  Criminal  Investigation  Command,”  December  6, 1994. 

AAA  Report  No.  HQ  94-C7,  “FY  94  Audit  Followup  Review  U.S.  Army  Materiel 
Command,”  September  12, 1994. 
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Appendix  C.  Other  Matters  of  Interest 


Organizational  Structures  and  Staffing  Levels 

According  to  DoD  Directive  7600.2,  the  establishment  of  IR  organizations  is  at 
the  discretion  of  each  Military  Department  Secretary.  The  Department  of  the 
Army  maintains  a  central  internal  audit  agency,  the  AAA,  and  a  separate  IR 
organization,  the  Army  IR.  The  Departments  of  the  Navy  and  the  Air  Force  also 
have  internal  audit  agencies,  the  Naval  Audit  Service  (NAS),  and  the  Air  Force 
Audit  Agency  (AFAA),  but  currently  do  not  also  have  separate  IR  organizations. 
See  the  following  table  that  shows  staffing  level  factors  and  operating  statistics 
reviewed. 

Organizational  Structures  and  Locations.  The  structure  of  the  Army  IR 
organizations  is  unlike  the  organizational  structures  of  the  other  Military 
Department  audit  organizations.  Specifically,  the  AAA,  the  NAS,  and  the  AFAA 
are  centralized  internal  audit  organizations  directly  responsible  to  the  respective 
Military  Department  auditors  general.  The  ASA  (FM&C)  has  overall  policy 
responsibility  for  the  Army  IR  program,  but  the  Army  IR  organizations  are 
decentralized  with  over  170  IR  offices.  The  Army  IR  auditors  work  directly  for 
the  commanders,  principal  deputy  commanders,  or  chiefs  of  staff.  In  addition, 
commanders  retain  the  approval  authority  for  the  IR  office  chiefs’  performance 
appraisals. 

Staffing  Levels.  The  Army  IR  is  unique  in  that  it  is  the  only  Military  Department 
internal  review  organization.  Therefore,  to  determine  whether  staffing  levels 
were  comparable,  we  combined  the  staffing  level  figures  for  the  Department  of 
the  Army  audit  organizations.  Army  IR,  and  AAA.  The  combined  staffing  levels 
of  the  AAA  and  the  Army  IR  are  generally  comparable  to  the  staffing  levels  of 
the  AFAA,  but  not  comparable  to  the  NAS.  According  to  the  FY  1997 
Semiannual  Reports  to  the  Congress,  the  Department  of  the  Army  audit 
organizations  were  staffed  with  1,016  auditors  (484  Army  IR  auditors  and 
532  AAA  auditors);  the  Naval  Audit  Service  was  staffed  with  491  auditors;  and 
the  AFAA  was  staffed  with  822  auditors.  The  Department  of  the  Army  has  more 
than  170  installations  and  activities,  the  Department  of  the  Navy  has 
approximately  106  installations  and  activities,  and  the  Department  of  the 
Air  Force  has  approximately  90  installations. 

The  Department  of  the  Navy  disestablished  its  IR  program  in  April  1989,  at 
which  time  there  were  about  530  IR  auditors.  The  Secretary  of  the  Navy 
Instruction  7510.9,  “Command  Management  Economy,  Efficiency  and  Review,” 
April  13,  1989,  cancelled  the  Navy  IR  program  and  replaced  it  with  a  command 
evaluation  function  staffed  with  non-auditors.  The  command  evaluation  program 
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is  similar  to  the  Army  IR  in  that  the  resources  are  the  commanders,  and  review 
results  are  distributed  only  to  the  responsible  commander.  But  the  command 
evaluation  program  is  dissimilar  to  the  Army  DR.  because  the  command  evaluators 
are  not  classified  as  Federal  employee  General  Schedule  series  511  auditors  and 
are  not  required  to  comply  with  GAGAS.  The  Department  of  the  Navy  does  not 
track  that  number  of  command  evaluation  personnel. 

The  Department  of  the  Air  Force  does  not  maintain  a  separate  IR  organization. 
The  AFAA  performs  command-level  internal  review  services  through  its 
Commander’s  Audit  Program  and  Management  Advisory  Services.  With  the 
Commander’s  Audit  Program,  commanders  may  request  an  AFAA  audit  to 
address  a  particular  area  of  concern.  The  review  results  are  usually  only  reported 
to  the  requesting  commander.  With  Management  Advisory  Services,  the  AFAA 
auditors  offer  consulting  services  and  usually  present  review  results  in  an  oral 
briefing  or  summary  memorandum. 


Workload  Mix 

Audit  work  accounted  for  about  38  percent  of  the  direct  staff  days  for  the  Army 
IR  organizations.  For  FY  1997,  audit  work  accounted  for  88  percent,  92  percent, 
and  95  percent  of  the  direct  staff  days  for  the  AAA,  NAS,  and  the  AFAA, 
respectively. 

Non-audit  work  (consulting  services)  accounted  for  12  percent,  9  percent,  and 
5  percent  of  the  direct  staff  days  for  the  AAA,  NAS,  and  the  AFAA,  respectively. 
On  the  other  hand,  non-audit  work  that  includes  consulting  services,  liaison,  and 
followup,  accounted  for  62  percent  of  the  direct  staff  days  for  the  Army  IR.  The 
calculation  for  direct  staff  days  for  Army  IR  is  based  on  a  reported  21  direct  staff 
days  for  FY  1997  times  Army  IR  products  issued.  Although  non-audit  type  work 
appears  to  be  increasing  within  DoD,  the  NAS  and  the  AFAA  have  established 
limits  on  the  amount  of  consulting  services  they  provide.  For  example,  the  AFAA 
set  a  limit  of  15  percent  of  its  auditors’  time  to  be  spent  on  providing  consulting 
services. 
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Organizational  structure 

Decentralized 

Centralized 

Centralized 

Centralized 

Responsible  to 

Local 

commanders 

Auditor 

General 
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General 

Auditor 

General 

Mission  statements 

Similar 

Similar 

Similar 

Similar 

Number  of  installations 

170 

170 

106 

90 

Number  of  audit  offices 

172 

24 

19 

52 

Total  1997  audit  personnel 

484 

532 

491 

822 

FY  1997  direct  staff  days: 


Audit 


Non-audit 


Total  direct  staff  days 


20,995  (38%)  I  78,847  (88%)  I  75,742(92%)  \  117,609(95%) 


34,667(62%)  11,139(12%)  6,591(8%)  6,170(5%) 


55,662  89,986  |  82,333  123,779 


Services  provided: 


Audits 


Consulting  reviews 


FY  1997  operating  costs 
(millions): _ 


Personnel  $28.93  I  $43.63 


Travel  .98  4.74 


Other  .64  2.96 


Total  FY  1997  operating 

costs  (millions)  $30.55  $51.33 


$40.98 


1.89 


3.10 


$45.97 


$58.28 


3.74 


2.26 


$64.28 
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Appendix  D.  Army  Internal  Review  Initiatives 


Performance  Measurements 


The  Army  JR  headquarters  designed  an  Army  IR  Performance  Measures  Guide, 
effective  September  8, 1997.  The  Guide,  which  provides  the  Army  IR 
performance  measurements,  goals,  and  strategic  plan  for  achieving  Army  IR 
goals,  was  designed  for  use  at  IR  offices  to  assess  IR  performance.  The  Army  IR 
measures  its  performance  based  on  such  factors  as  return  on  investment,  auditor 
productivity,  effective  use  of  Army  IR,  and  customer  satisfaction. 


Process  Improvement  Teams 

During  our  evaluation,  the  Army  IR  headquarters  initiated  several  process 
improvement  teams  to  improve  certain  areas  within  the  Army  IR  program.  The 
following  is  a  list  of  some  of  the  on-going  process  improvement  teams  and  their 
respective  objectives. 

Audit  Time  Reporting.  The  mission  of  the  process  improvement  team, 
established  on  June  1, 1998,  is  to  develop  Army  IR  policies  and  guidance  for 
calculating  and  reporting  audit  time.  The  process  improvement  team  results  are 
scheduled  to  be  completed  by  June  30, 1999. 

Consulting  and  Advisory  Services.  The  mission  of  the  process  improvement 
team,  established  on  June  1 1 , 1 998,  is  to  produce  an  easy  to  use  reference  that  will 
guide  Army  IR  auditors  in  the  performance  of  highly  effective  consulting  and 
advisory  services  that  serve  the  needs  of  their  customers  and  meet  applicable 
professional  standards.  The  process  improvement  team  was  chartered  to  complete 
the  following  objectives  by  March  31, 1999: 

•  validate  the  current  Army  IR  guidance  on  consulting  and  advisory  services 
to  ensure  that  it  represents  the  most  current  body  of  knowledge  and  that 
lessons  learned  have  been  incorporated; 

•  develop  revised  guidance  as  necessary;  and 

•  ensure  that  current  and  proposed  guidance  meets  professional  standards 
and  agency  policy. 

Army  IR  Access  to  Information.  The  mission  of  the  process  improvement  team, 
established  June  15, 1998,  is  to  develop  Army  IR  guidance  on  access  to 


19 


information  during  the  performance  of  full-scope  audits,  quick  response  audits, 
consulting  services,  and  followup  reviews.  The  process  improvement  team  was 
chartered  to  complete  the  following  objectives  by  June  30, 1999: 

•  research  existing  policies  and  guidance  granting  access  to  agency  or 
activity  information; 

•  develop  Army  DR.  policy  to  cover  the  granting  of  access  to  records,  files, 
documents,  and  databases  when  conducting  Army  IR  services;  and 

•  research  computer  software  systems  for  data  retrieval  capabilities. 

Outsourcing  Internal  Audit.  The  mission  of  the  process  improvement  team, 
established  on  June  2, 1998,  is  to  develop  policies  and  guidelines  governing  the 
outsourcing  of  internal  audit  work  within  the  Army.  The  process  improvement 
team  was  chartered  to  complete  the  following  objectives  by  September  30, 1999: 

•  develop  and  recommend  Army  policies  for  outsourcing  local  and 
command-wide  audit  work; 

•  develop  guidance  to  assist  local  Army  DR.  offices  in  defining  work 
requirements  and  statements  of  work;  and 

•  develop  checklists  to  assist  local  Army  IR  offices  in  serving  as  contractor 
technical  representatives  in  monitoring  vendor  compliance. 

According  to  DoD  Directive  7600.2,  the  Inspector  General,  DoD,  is  responsible 
for  establishing  the  guidelines  for  determining  when  non-Federal  auditors  should 
be  used  and  for  taking  appropriate  steps  to  ensure  that  work  performed  by 
non-Federal  auditors  complies  with  GAGAS.  The  Army  IR  needs  to  comply  with 
the  requirement  to  obtain  prior  approval  in  outsourcing  determinations. 


Electronic  Reporting 

The  Army  IR  headquarters  implemented  its  new  electronic  reporting  system 
during  November  1998.  The  Army  IR  headquarters,  in  coordination  with  the 
AAA,  developed  a  system  to  submit  information  for  the  semiannual  reports  to  the 
Congress  and  semiannual  followup  status  reports  using  the  Internet.  The  Army 
IR  headquarters*  objectives  in  implementing  this  electronic  reporting  system  was 
to  streamline  the  Army  DR.  reporting  requirements;  improve  the  accuracy  of  the 
submitted  reports;  reduce  the  time  spent  on  preparing  the  semiannual  reports,  and 
improve  the  MACOM  IR  offices  oversight  of  subordinate  installation  Army  IR 
offices  required  reporting. 
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Department  of  the  Army  Comments 


DEPARTMENT  OF  THE  ARMY 
OFFICE  OF  THE  AM  I  ST  AWT  SECRJETABY 
FINANCIAL  MANAGEMENT  AND  COMPTROLLER 
109  ARMY  PENTAGON 
WASHINGTON  DC  90310-0109 

February  9, 1999 


MEMORANDUM  FOR  DEPUTY  ASSISTANT  INSPECTOR  GENERAL  FOR 
AUDIT  POLICY  AND  OVERSIGHT 

SUBJECT:  Evaluation  Report  on  the  Department  of  the  Army  Internal  Review 
Organizations  (Project  No.  70A-1005) 


We  have  reviewed  your  draft  evaluation  report  of  the  Army  Internal 
Review  Organizations  (Project  70A-1005)  and  offer  the  following  comments: 

FINDING  A:  While  we  concur  with  this  finding,  the  statement  that  62 
percent  of  Army  Internal  Review's  direct  time  was  spent  on  non-audit  work 
sounds  somewhat  misleading  for  it  does  not  identify  the  fact  that  the  work  was  a 
significant  part  of  the  assigned  mission. 

CORRECTIVE  ACTIONS: 

RECOMMENDATION  A1:  Concur  A  memorandum  stressing  the  need 
for  alt  Interna!  Review  (IR)  auditors  to  comply  with  continuing  professional 
education  (CPE)  requirements  will  be  published  not  later  than  March  15. 1999. 

RECOMMENDATION  A2:  While  we  concur  that  supervisory  review  of  IR 
work  is  necessary,  the  level  of  detail  required  is  subjective.  Government 
Auditing  Standards  understand  this  when  they  state  in  paragraph  3  32  ‘The 
nature  and  extent  of  on  organization's  Internal  quality  control  system  depends  on 
a  number  of  factors,  such  as  Its  size,  the  degree  of  operating  autonomy  allowed 
Its  personnel  and  its  audit  offices,  the  nature  of  its  work,  its  organizational 
structure,  and  appropriate  cost-benefit  considerations.  Thus,  the  systems 
established  by  individual  organizations  will  vary,  as  will  the  extent  of  their 
documentation." 

For  full  scope  audits,  where  Implications  of  wrongdoing  or  similar  serious 
situations  exist,  It  Is  imperative  that  a  detailed  supervisory/intemal  quality  control 
review  occur.  However,  for  quick  response  audits  and  consulting  engagements 
performed  by  an  experienced  auditor,  a  cursory  review  should  be  all  that  is 
required.  It  is  more  Important  for  IR  to  use  its  time  in  direct  support  of  command 
requirements.  A  guide  for  determining  the  level  of  supervisory  review  of  IR 
engagements  in  keeping  With  Government  Auditing  Standards  will  be 
incorporated  into  AR 1 1-7  and  published  within  one  year. 
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RECOMMENDATION  A4:  Concur.  A  memorandum  Identifying  key 
elements  of  supervisory  performance  plans  for  IR  personnel  will  be  published 
not  later  than  March  15,  1999 

RECOMMENDATION  A$:  Concur.  A  memorandum  stressing  the  need 
for  Army  MACOMs  to  ensure  alt  subordinate  IR  offices  receive  an  external 
quality  assurance  review  at  not  less  than  3-year  intervals  will  be  published  not 
later  than  March  15,  1999. 

RECOMMENDATION  AS:  (From  The  Auditor  General)  Concur 
However,  we  believe  the  one  year  timeframe  specified  In  Recommendation  A5 
may  not  allow  a  sufficient  time  interval  for  Army  Internal  Review  to  fully 
Implement  corrective  actions  for  all  the  recommendations  addressed  to  them. 

FINDING  B:  This  finding  points  out  the  fag  time  between  changes  in 
business  practices  and  published  guidance.  The  nature  of  modem  internal 
auditing  makes  yearlong  planning  obsolete.  IR  offices  are  generally  using  most 
of  their  time  responding  to  immediate  need  requests  from  the  commander  and 
staff.  In  fact,  a  sure  means  to  Identify  a  poorly  performing  IR  office  is  to 
determine  if  the/re  on  schedule  with  the  annual  plan  If  it  is  more  than  30  days 
into  the  plan  and  the/re  still  on  track,  they  aren’t  being  used  for  critical,  time 
sensitive  issues  by  the  command. 

RECOMMENDATION  B:  Concur  The  draft  AR  11-7  will  be  revised  to 
Incorporate  planning  guidance  developed  by  an  IR  Process  Action  Team  in 
1998.  This  guidance  will  foster  a  dynamic  and  flexible  approach  to  IR  planning 
Publication  of  a  new  AR  1 1-7  will  take  place  within  1  year 

We  appreciate  the  opportunity  to  comment  on  your  report.  Should  you 
have  any  questions,  please  contact  Mrs.  Karen  K.  Wolff,  Director,  Financial 
Reporting  and  Internal  Review  at  (703)  695-2909 


CF: 

The  Auditor  Genera! 
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Evaluation  Team  Members 


The  Financial,  Performance,  and  Single  Audit  Division,  Office  of  the  Deputy 
Assistant  Inspector  General  for  Audit  Policy  and  Oversight,  DoD,  produced  this 
report. 

Donald  E.  Davis 
Barbara  E.  Smolenyak 
Martin  T.  Heacock 
Shirley  W.  Willard 
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